alkdev/alkstore

0 Fork 0

Files

T

History

glm-5.3-flash 321f579ac2 pg: surface the forwarder's swallowed connect/poll failures (review 004 item 7's two narrow arms, pg-fix-forwarder-diagnosability) — output form per the ADR-025 decision of record: the reconnect arm's .ok() swallow at the loop's attempt closure becomes a tracing::warn! per failed connect (attempt index mapping the backoff state — 50 ms base doubling to the 2 s cap — plus the raw io-class connect error; reconnect_with_retry's generic signature and its two unit pins unchanged); poll_loop returns the fatal poll_message error instead of discarding it and the serve loop's poll-death arm surfaces the ending as a tracing::error! (fatal error, no-error stream close, and the join abort/panic variant — each naming the death and the stall-until-reconnect consequence); secret-free re-verified by grep — both new emission contents checked against the substrate (tokio-postgres 0.7.18 connect errors are Error::connect(io::Error), no DSN/user/password in Display; no subscriber-asserting test added, holding ADR-025's dev-dep stance); gates green: full crate suite against the harness server (135+25+9, all pre-existing forwarder/reconnect pins and the hardening task's pins green unchanged), workspace build/tests server-less, clippy -D warnings, fmt, doc gate, fuzz corpus replay 6/6; task -> completed

2026-10-11 14:25:29 +00:00

..

pg: surface the forwarder's swallowed connect/poll failures (review 004 item 7's two narrow arms, pg-fix-forwarder-diagnosability) — output form per the ADR-025 decision of record: the reconnect arm's .ok() swallow at the loop's attempt closure becomes a tracing::warn! per failed connect (attempt index mapping the backoff state — 50 ms base doubling to the 2 s cap — plus the raw io-class connect error; reconnect_with_retry's generic signature and its two unit pins unchanged); poll_loop returns the fatal poll_message error instead of discarding it and the serve loop's poll-death arm surfaces the ending as a tracing::error! (fatal error, no-error stream close, and the join abort/panic variant — each naming the death and the stall-until-reconnect consequence); secret-free re-verified by grep — both new emission contents checked against the substrate (tokio-postgres 0.7.18 connect errors are Error::connect(io::Error), no DSN/user/password in Display; no subscriber-asserting test added, holding ADR-025's dev-dep stance); gates green: full crate suite against the harness server (135+25+9, all pre-existing forwarder/reconnect pins and the hardening task's pins green unchanged), workspace build/tests server-less, clippy -D warnings, fmt, doc gate, fuzz corpus replay 6/6; task -> completed

2026-10-11 14:25:29 +00:00

Contract-suite rows (task suite-opts-backoff-rows): the backoff-curve equivalence row and the deferred enqueue-opts clock legs. backoff_curve_equivalence — the equal-jitter exponential pinned as the range, not a jitter label (ADR-010 §3): claim → retry(err, None) cycles on a backoff_base_s = 2 queue land the ranges [1,2], [2,4], [4,8] across attempts 1–3, each computed delay read back through get_job's resolved run_at minus a clock read taken before the retry — the lower bound race-free (the retry's internal clock read cannot precede the suite's, so the observed value over-reads the delay, never under-reads) and the upper bound carrying a one-second straddle tolerance for the integer-second stamp crossing a wall second; identical bounds on both engines is the equivalence pin (ADR-012 §2, the row body shared). The explicit-delay override legs ride the same row: retry(err, Some(5)) honored verbatim ([5, 6] under the same straddle tolerance) and retry(err, Some(0)) resolving ready-now per the boundary-total rule (ADR-023 §2), claimed within a bounded wait. enqueue_opts_resolution extended in place with the wave-5 legs its deferral note named — the run_at-alone literal leg (a future run_at is the row's ready time verbatim, a deterministic equality with no clock read involved; a past run_at stores the literal too and is claimable now through the run_at <= now predicate within a bounded wait, the run_at-ASC ordering making the observation unambiguous among the row's other legs) and the neither-field leg (ready at the enqueue instant, abs_diff(now) <= 5 tolerance-bounded proximity, never a tight timing assert); the deferral note replaced by the completion statement, ADR-023 §2 stamp accumulated per the convention (ADR-020 §1 governs the resolutions). Cap-leg disposition recorded in Notes for the review gate: the 1-hour cap is not suite-pinnable (capped attempts need minute-scale waits) and stays pinned engine-side on both engines' unit tests per the wave-3/4 reviews. Ready-now waits are bounded claim_one poll loops (deadline asserts only, sequential single-store drive), with the one draft defect the finding surfaced (a re-claim after the bounded wait consumed nothing; the helper returns the claimed handle) noted. Wired into both engines' suite targets (SQLite tokio test, pg harness_row!), 25 rows per column up from 24. Verified: SQLite column green server-less (25/25 suite, 189 lib), pg column green vs harness (postgres/poc@:15432 — 25/25 suite, 121 lib + 9 schema), 3 solo re-runs of each new/extended row per engine (determinism), server-less pg skips cleanly via the reachability gate, cargo test -p alkstore-sqlite -p alkstore-postgres green, clippy -D warnings, fmt clean

2026-10-10 07:26:55 +00:00

Cargo.toml

adopt the tracing log facade, engine crates only (review 004 item 7's family-level decision, ADR-025): the family precedent checked and unanimous (alkcall/alktunnels/alksocks/alktty all on tracing = "0.1" facade-only, tracing-subscriber env-filter a dev-dep where present, silent by default); user sign-off taken in-session (2026-10-11, adopt-tracing option chosen) and recorded in the ADR's status; core stays dep- and emit-free (the explicit core-dep answer — the payload serde deps remain the sole core deps, the ADR states the ADR-020-§4 reading explicitly); all 19 library-path eprintln! sites migrated to tracing::warn!/error! with message text + the alkstore: prefix + the secret-free discipline unchanged (17 at review time, +2 from the review's own inline tick/lease restructures — re-grepped, sqlite 10 / pg 9, zero remainder, tests' harness-skip prints untouched); levels: warn = retried/degraded ops, error = unrecoverable loss (watcher death, discarded pooled clients, panic-path rollback failures); the four substrate-lineage files ride PROVENANCE delta D-41 (message-identical macro swap); deployment.md gains the diagnostics-posture section (operator recipe RUST_LOG=warn/error at the consuming binary; listener application_name diagnosability joins it), ADR index + design-decisions table carry the 025 row, CHANGELOG's 0.1.0 body states the facade; pg-fix-forwarder-diagnosability's output form now pinned (warn on failed reconnect connects with attempt/backoff context, error on the loop-exit poll error); gates green: build, workspace tests server-less, clippy -D warnings, fmt, doc gate zero warnings, fuzz corpus replay 6/6; task -> completed

2026-10-11 14:19:07 +00:00

LICENSE-APACHE

release-publish-prep: license texts ride each package — LICENSE-MIT/LICENSE-APACHE copies in the four published crate dirs (cargo's auto-detect packages them; workspace-inherited license-files is a packaging no-op on cargo 1.99, reverted); the sqlite substrate's bundled in-src notice stays per ADR-018

2026-10-11 08:05:09 +00:00

LICENSE-MIT

release-publish-prep: license texts ride each package — LICENSE-MIT/LICENSE-APACHE copies in the four published crate dirs (cargo's auto-detect packages them; workspace-inherited license-files is a packaging no-op on cargo 1.99, reverted); the sqlite substrate's bundled in-src notice stays per ADR-018

2026-10-11 08:05:09 +00:00

README.md

release-readme: the root README written last, honestly — crate family table with per-engine honest postures (ADR-016 compile-time identity, deployment.md as the boundary), mem-carried usage sketch compile-checked and executed against the real API, contract-suite pointer (three engines, one pinned contract), license note; LICENSE-MIT + LICENSE-APACHE per the family pattern (substrate notice untouched per ADR-018); CHANGELOG seeded with the 0.1.0 contract-v1 entry; per-crate readme wiring decided + landed (pointer-style per-crate readmes, readme fields wired on the four published crates); honesty trace list in task Notes; task -> completed

2026-10-11 01:32:33 +00:00

README.md

alkstore-postgres

The Postgres engine of the alkstore family: the core contract implemented on tokio-postgres + deadpool-postgres, natively async (no blocking bridge, no spawn_blocking seam), with a hand-rolled LISTEN forwarder.

let store = alkstore_postgres::open(&dsn, alkstore_postgres::PgOpts::default()).await?;

Engine posture — multi-host native. Connections are per-process state; nothing assumes a shared host. Connection budget: max_size pooled connections + 1 non-pooled listener connection per LISTEN-ing process (pooled connections cannot carry LISTEN) — size the server for the sum. v1 TLS is effectively unavailable: the engine hardwires NoTls on every connection path, so network confidentiality must come from the deployment topology. Queue/stream/lock/schedule tables live in one engine-owned PostgreSQL schema (default alkstore, per-engine option).

See the family README for the interface and the deployment matrix, and the Postgres engine spec for the driver's details.